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THE APPLICATION IDENTIFIED ABOVE HAS BEEN EXAMINED AND IS ALLOWED FOR ISSUANCE AS A PATENT. 
PROSECUTION ON THE MERITS IS CLOSED . THIS NOTICE OF ALLOWANCE IS NOT A GRANT OF PATENT RIGHTS. 
THIS APPLICATION IS SUBJECT TO WITHDRAWAL FROM ISSUE AT THE INITIATIVE OF THE OFFICE OR UPON 
PETITION BY THE APPLICANT. SEE 37 CFR 1.313 AND MPEP 1308. 

THE ISSUE FEE AND PUBLICATION FEE (IF REQUIRED) MUST BE PAID WITHIN THREE MONTHS FROM THE 
MAILING DATE OF THIS NOTICE OR THIS APPLICATION SHALL BE REGARDED AS ABANDONED. THIS 
STATUTORY PERIOD CANNOT BE EXTENDED . SEE 35 U.S.C. 151. THE ISSUE FEE DUE INDICATED ABOVE 
REFLECTS A CREDIT FOR ANY PREVIOUSLY PAID ISSUE FEE APPLIED IN THIS APPLICATION. THE PTOL-85B (OR 
AN EQUIVALENT) MUST BE RETURNED WITHIN THIS PERIOD EVEN IF NO FEE IS DUE OR THE APPLICATION WILL 
BE REGARDED AS ABANDONED. 

HOW TO REPLY TO THIS NOTICE: 

I. Review the SMALL ENTITY status shown above. 

If the SMALL ENTITY is shown as YES, verify your current 
SMALL ENTITY status: 

A. If the status is the same, pay the TOTAL FEE(S) DUE shown 
above. 

B. If the status above is to be removed, check box 5b on Part B - 
Fee(s) Transmittal and pay the PUBLICATION FEE (if required) 
and twice the amount of the ISSUE FEE shown above, or 



If the SMALL ENTITY is shown as NO: 



A. Pay TOTAL FEE(S) DUE shown above, or 



B. If applicant claimed SMALL ENTITY status before, or is now 
claiming SMALL ENTITY status, check box 5a on Part B - Fee(s) 
Transmittal and pay the PUBLICATION FEE (if required) and 1/2 
the ISSUE FEE shown above. 



II. PART B - FEE(S) TRANSMITTAL should be completed and returned to the United States Patent and Trademark Office (USPTO) with 
your ISSUE FEE and PUBLICATION FEE (if required). Even if the fee(s) have already been paid, Part B - Fee(s) Transmittal should be 
completed and returned. If you are charging the fee(s) to your deposit account, section "4b" of Part B - Fee(s) Transmittal should be 
completed and an extra copy of the form should be submitted. 

III. All communications regarding this application must give the application number. Please direct all communications prior to issuance to 
Mail Stop ISSUE FEE unless advised to the contrary. 

IMPORTANT REMINDER: Utility patents issuing on applications filed on or after Dec. 12, 1980 may require paynrent of 
maintenance fees. It is patentee's responsibility to ensure timely payment of maintenance fees when due. 
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IT B - FEE(S) TRANSMITTAL 
Complete and send this form, together with applicable fee(s), to: Mail 



or Fax 



Mail Stop ISSUE FEE 
Commissioner for Patents 
P.O. Box 1450 

Alexandria, Virginia 22313-1450 
(703) 746-4000 



INSTRUCTIONS: This form should be used for transmitting the ISSUE FEE and PUBLICATION FEE (if required). Blocks 1 through 5 should be completed where 
appropriate. All further correspondence including the Patent, advance orders and notification of maintenance fees will be mailed to the current correspondence address as 
indicated unless corrected below or directed otherwise in Block 1, by (a) specifying a new correspondence address; and/or (b) indicating a separate "FEE ADDRESS" for 
maintenance fee notifications. 
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Note: A certificate of mailing can only be used for domestic mailings of the 
Fee(s) Transmittal. This certificate cannot be used for any other accompanying 
papers. Each additional paper, such as an assignment or formal drawing, must 
have its own certificate of mailing or transmission. 

Certificate of Mailing or Transmission 

I hereby certify that this Feefs) Transmittal is being deposited with the United 
States Postal Service with sufficient postage for first class mail in an envelope 
addressed to the Mail Stop ISSUE FEE address above, or being facsimile 
transmitted to the USPTO (703) 746-4000, on the date indicated below. 
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1. Change of correspondence address or indication of "Fee Address" (37 
CFR1J63). 

Q Change of correspondence address (or Change of Correspondence 
Address form PTO/SB/122) attached. 

Q "Fee Address" indication (or "Fee Address" Indication form 
PTO/SB/47; Rev 03-02 or more recent) attached. Use of a Customer 
Number is required. 



2. For printing on the patent front page, list 

(1) the names of up to 3 registered patent attorneys 
or agents OR, alternatively, 

(2) the name of a single firm (having as a member a 
registered attorney or agent) and the names of up to 
2 registered patent attorneys or agents. If no name is 
listed, no name will be printed. 



3. ASSIGNEE NAME AND RESIDENCE DATA TO BE PRINTED ON THE PATENT (print or type) 

PLEASE NOTE: Unless an assignee is identified below, no assignee data will appear on the patent. If an assignee is identified below, the document has been filed for 
recordation as set forth in 37 CFR 3. 1 1 . Completion of this form is NOT a substitute for filing an assignment. 



(A) NAME OF ASSIGNEE 



(B) RESIDENCE: (CITY and STATE OR COUNTRY) 



Please check the appropriate assignee category or categories (will not be printed on the patent) : Q Individual Q Corporation or other private group entity Q Government 
4a, The following fee(s) are enclosed: 4b. Payment of Fee(s): 

Q Issue Fee Q A check in the amount of the fee(s) is enclosed. 

Q Publication Fee (No small entity discount permitted) Q Payment by credit card. Form PTO-2038 is attached. 

□ Advance Order- # of Copies Q The Director is hereby authorized by charge the required fee(s), or credit any overpayment, to 

Deposit Account Number (enclose an extra copy of this form). 

5. Change in Entity Status (from status indicated above) 

□ a. Applicant claims SMALL ENTITY status. See 37 CFR 1 .27. □ b. Applicant is no longer claiming SMALL ENTITY status. See 37 CFR 1.27(g)(2). 

The Director of the USPTO is requested to apply the Issue Fee and Publication Fee (if any) or to re-apply any previously paid issue fee to the application identified above. 
NOTE: The Issue Fee and Publication Fee (if required) will not be accepted from anyone other than the applicant; a registered attorney or agent; or the assignee or other party in 
interest as shown by the records of the United States Patent and Trademark Office. 



Authorized Signature Date 

Typed or printed name Registration No. 

This collection of information is required by 37 CFR 1 .3 1 1 . The information is required to obtain or retain a benefit by the public which is to file (and by the USPTO to process) 
an application. Confidentiality is governed by 35 U.S.C. 122 and 37 CFR 1.14. This collection is estimated to take 12 minutes to complete, including gathering, preparing, and 
submitting the completed application form to the USPTO. Time will vary depending upon the individual case. Any comments on the amount of time you require to complete 
this form and/or suggestions for reducing this burden, should be sent to the Chief Information Officer, U.S. Patent and Trademark Office, U.S. Department of Commerce, P.O. 
Box 1450, Alexandria, Virginia 22313-1450. DO NOT SEND FEES OR COMPLETED FORMS TO THIS ADDRESS. SEND TO: Commissioner for Patents, P.O. Box 1450, 
Alexandria, Virginia 223 if- 1450. 

Under the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a valid OMB control number. 



PTOL-85 (Rev. 08/04) Approved for use through 04/30/2007. 



OMB 065 1 -0033 U.S. Patent and Trademark Office; U.S. DEPARTMENT OF COMMERCE 




United States Patent and Trademark Office 



UNITED STATES DEPARTMENT OF COMMERCE 
United States Patent and Trademark Office 
Address: COMMISSIONER FOR PATENTS 
P.O. Box 1450 

Alexandria, Virginia 22313-1450 
www.uspto.gov 



APPLICATION NO. 


FILING DATE 


FIRST NAMED INVENTOR 


ATTORNEY DOCKET NO. 


CONFIRMATION NO. 


09/757,963 


01/10/2001 


John S. Flowers 


HVWD-01008USO 


9385 






MEM/SB S 





00758 7590 08/25/2004 

FENWICK & WEST LLP 
SILICON VALLEY CENTER 
801 CALIFORNIA STREET 
MOUNTAIN VIEW, CA 94041 



EXAMINER 



MOORTHY, ARAVIND K 



ART UNIT 



PAPER NUMBER 



2131 

DATE MAILED: 08/25/2004 



Determination of Patent Term Adjustment under 35 U.S.C. 154 (b) 

(application filed on or after May 29, 2000) 

The Patent Term Adjustment to date is 353 day(s). If the issue fee is paid on the date that is three months after the 
mailing date of this notice and the patent issues on the Tuesday before the date that is 28 weeks (six and a half 
months) after the mailing date of this notice, the Patent Term Adjustment will be 353 day(s). 

If a Continued Prosecution Application (CPA) was filed in the above-identified application, the filing date that 
determines Patent Term Adjustment is the filing date of the most recent CPA. 

Applicant will be able to obtain more detailed information by accessing the Patent Application Information Retrieval 
(PAIR) WEB site (http://pair.uspto.gov). 

Any questions regarding the Patent Term Extension or Adjustment determination should be directed to the Office of 
Patent Legal Administration at (703) 305-1383. Questions relating to issue and publication fee payments should be 
directed to the Customer Service Center of the Office of Patent Publication at (703) 305-8283. 
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Notice of Fee Increase on October 1, 2004 

If a reply to a "Notice of Allowance and Fee(s) Due" is filed in the Office on or after October 1, 2004, then the 
amount due will be higher than that set forth in the "Notice of Allowance and Fee(s) Due" because an increase in fees 
effective on October 1, 2004 is anticipated. See Revision of Patent Fees for Fiscal Year 2005 : Proposed Rule . 69 Fed. 
Reg. 25861, 25863, 25864 (May 10, 2004). 

The current fee schedule is accessible from WEB site (http://www.uspto.gov/maiii/howtofees.htm). 

If the fee paid is the amount shown on the "Notice of Allowance and Fee(s) Due" but not the correct amount in view 
of the fee increase, a "Notice of Pay Balance of Issue Fee" will be mailed to applicant. In order to avoid processing 
delays associated with mailing of a "Notice of Pay Balance of Issue Fee," if the response to the Notice of Allowance 
is to be filed on or after October 1, 2004 (or mailed with a certificate of mailing on or after October 1, 2004), the 
issue fee paid should be the fee that is required at the time the fee is paid. See Manual of Patent Examining Procedure 
fMPEPV Section 1306 (Eighth Edition, Rev. 2, May 2004). If the issue fee was previously paid, and the response to 
the "Notice of Allowance and Fee(s) Due" includes a request to apply a previously-paid issue fee to the issue fee 
now due, then the difference between the issue fee amount at the time the response is filed and the previously-paid 
issue fee should be paid. See MPEP Section 1308.01 . 

Effective October 1, 2004, 37 CFR 1.18 is proposed to be amended by revising paragraphs (a) through (c) to read as 
set forth below. As stated above, the final fee may be a different amount, and applicant should check the WEB site 
given above when paying the fee. 

Section 1.18 Patent post allowance (including issue) fees. 

(a) Issue fee for issuing each original or reissue patent, 
except a design or plant patent: 

By a small entity (Sec. 1.27(a)) $670.00 

By other than a small entity $1,340.00 

(b) Issue fee for issuing a design patent: 

By a small entity (Sec. 1 .27(a)) $245.00 

By other than a small entity $490.00 

(c) Issue fee for issuing a plant patent: 

By a small entity (Sec. 1.27(a)) $325.00 

By other than a small entity $650.00 

Questions relating to issue and publication fee payments should be directed to the Customer Service Center of the 
Office of Patent Publication at (703) 305-8283. 
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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address- 

All claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
herewith (or previously mailed), a Notice of Allowance (PTOL-85) or other appropriate communication will be mailed in due course. THIS 
NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1308. 

1 . ^ This communication is responsive to 8/19/04 . 

2. £3 The allowed claim(s) is/are 5-13, 15-25,27-37.39 and 40 . 

3. ^ The drawings filed on 10 January 2001 are accepted by the Examiner. 

4. □ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 

a) □ All b) □ Some* c) □ None of the: 

1. □ Certified copies of the priority documents have been received. 

2. □ Certified copies of the priority documents have been received in Application No. . 

3. □ Copies of the certified copies of the priority documents have been received in this national stage application from the 

International Bureau (PCT Rule 17.2(a)). 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
noted below. Failure to timely comply will result in ABANDONMENT of this application. 
THIS THREE-MONTH PERIOD IS NOT EXTENDABLE. 

5. □ A SUBSTITUTE OATH OR DECLARATION must be submitted. Note the attached EXAMINER'S AMENDMENT or NOTICE OF 

INFORMAL PATENT APPLICATION (PTO-152) which gives reason(s) why the oath or declaration is deficient. 

6. □ CORRECTED DRAWINGS ( as "replacement sheets") must be submitted. 

(a) □ including changes required by the Notice of Draftsperson's Patent Drawing Review ( PTO-948) attached 

1) □ hereto or 2) □ to Paper No./Mail Date . 

(b) □ including changes required by the attached Examiner's Amendment / Comment or in the Office action of 

Paper No./Mail Date . 

Identifying indicia such as the application number (see 37 CFR 1.84(c)) should be written on the drawings in the front (not the back) of 
each sheet. Replacement sheet(s) should be labeled as such in the header according to 37 CFR 1.121(d). 

7. □ DEPOSIT OF and/or INFORMATION about the deposit of BIOLOGICAL MATERIAL must be submitted. Note the 

attached Examiner's comment regarding REQUIREMENT FOR THE DEPOSIT OF BIOLOGICAL MATERIAL. 



Attachment(s) 

1. 13 Notice of References Cited (PTO-892) 

2. □ Notice of Draftperson's Patent Drawing Review (PTO-948) 

3. □ Information Disclosure Statements (PTO-1449 or PTO/SB/08), 

Paper No./Mail Date 

4. □ Examiner's Comment Regarding Requirement for Deposit 

of Biological Material 



5. □ Notice of Informal Patent Application (PTO-152) 

6. Interview Summary (PTO-413), 
Paper No./Mail Date 22 . 

7. ^ Examiner's Amendment/Comment 

8. M Examiner's Statement of Reasons for Allowance 

9. □ Other . 



1 AYAZ SHEIKH 
SUPERVISORY PATENT EXAMINER 
TECHNOLOGY CENTER 2100 



U.S. Patent and Trademark Office 
PTOL-37 (Rev. 1-04) 



Notice of Allowability 



Part of Paper No./Mail Date 22 




Application/Control Number: 09/757,963 Page 2 

Art Unit: 2131 

DETAILED ACTION 

1 . Claims 5-40 are pending in the application. 

2. Claims 5-13, 15-25, 27-37, 39 and 40 have been allowed. 

3. Claims 14, 26 and 38 have been cancelled. 

EXAMINER'S AMENDMENT 

4. An examiner's amendment to the record appears below. Should the changes and/or 
additions be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 
1.312. To ensure consideration of such an amendment, it MUST be submitted no later than the 
payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview with 



Dorian Cartwright on August 19, 2004. 



The application has been amended as follows: 



Claim t. (amended) A computer-implemented system for protecting a network, comprising: 

a vulnerability detection system (VDS) for gathering information about the network to 
determine vulnerabilities of a host from a plurality of hosts on the network; and 

an intrusion detection system (IDS), cooperative with the VDS, for examining network 
traffic responsive to the vulnerabilities of the host from the plurality of hosts as determined by 

the VDS to detect traffic indicative of malicious activity. 

CMmJn. (amended) A computer-implemented method for protecting a network comprising: 

gathering information about the network to determine vulnerabilities of a host from a 
plurality of hosts on the network; and 



it 
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cooperative with the step of gathering information, examining network traffic responsive 
to the determined vulnerabilities of the host from the plurality of hosts to detect network traffic 

indicative of malicious activity. 

£1 " — » 

Claim 2# (amended) A computer program product, comprising: 

a computer-readable medium having computer program logic embodied therein for 
protecting a network, the computer logic: 

gathering information about the network to determine vulnerabilities of a host 

from plurality of hosts on the network; and 

cooperative with the step of gathering information, examining network traffic 

responsive to the determined vulnerabilities of the host from the plurality of hosts to 

detect network traffic indicative of malicious activity. 

Allowable Subject Matter 
5. Claims 5-13, 15-25, 27-37, 39 and 40 are allowed. 

The following is an examiner's statement of reasons for allowance. As to independent 
claims 5, 17 and 29, prior art teaches the use a vulnerability detection system (VDS) for 
gathering information about the network to determine vulnerabilities of one or more hosts on a 
network (i.e. Todd, Sr. et al US 6,185,689 Bl). Prior art also teaches an intrusion detection 
system (EDS) for examining network traffic responsive to the vulnerabilities of the host from the 
plurality of hosts as determined by the VDS to detect traffic indicative of malicious activity (i.e. 
Teal US 6,477,651 Bl). 

However, prior art does not disclose, teach or fairly suggest that the EDS operates 
cooperatively with the VDS. 



3? 
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Todd, Sr. et al differs from the current application in that it is purely a VDS. The method 
assesses security vulnerabilities of one or more target hosts by a remote or local host via a server. 
However Todd, Sr. et al does not have an IDS for examining the network traffic responsive to 
the vulnerabilities of the host determined by the VDS. Teal differs from the current application 
in that it is purely an IDS. Vulnerabilities are determined by analyzing network traffic. 
Signatures associated with each network vulnerability are determined by investigating specific 
patterns on network data associated with an attack on the vulnerability. 

The dependant claims, being further limiting to the independent claims, definite and 
enabled by the specification are also allowed. 

Any comments considered necessary by applicant must be submitted no later than the 
payment of the issue fee and, to avoid processing delays, should preferably accompany the issue 
fee. Such submissions should be clearly labeled "Comments on Statement of Reasons for 
Allowance " 
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Conclusion 



6. 



Any inquiry concerning this communication or earlier communications from the 



examiner should be directed to Aravind K Moorthy whose telephone number is 703-305-1373. 
The examiner can normally be reached on Monday-Friday, 8:00-5:30. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz R Sheikh can be reached on 703-305-9648. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 



Aravind K Moorthy 
August 19, 2004 
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